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ABSTRACT 


As a critical part of the NASA Constellation Program lunar transportation architecture, the Altair lunar 
lander will return humans to the moon and enable a sustained program of lunar exploration. The Altair is 
to deliver up to four crew to the surface of the moon and return them to low lunar orbit at the completion of 
their mission. Altair will also be used to deliver large cargo elements to the lunar surface, enabling the 
buildup of an outpost. The Altair Project initialized its design using a “minimum functionality” approach 
that identified critical functionality required to meet a minimum set of Altair requirements. The Altair team 
then performed several analysis cycles using risk-informed design to selectively add back components and 
functionality to increase the vehicle’s safety and reliability. The analysis cycle results were captured in a 
reference Altair design. This design was reviewed at the Constellation Lunar Capabilities Concept Review, 
a Mission Concept Review, where key driving requirements were confirmed and the Altair Project was 
given authorization to began Phase A project formulation. A key objective of Phase A is to revisit the 
Altair vehicle configuration, to better optimize it to complete its broad range of crew and cargo delivery 
missions. Industry was invited to partner with NASA early in the design to provide their insights regarding 
Altair configuration and key engineering challenges. NASA intends to continue to seek industry 
involvement in project formulation activities. This paper will update the international community on the 
status of the Altair Project as it addresses the challenges of project formulation, including optimizing a 
vehicle configuration based on the work of the NASA Altair Project team, industry inputs and the plans 
going forward in designing the Altair lunar lander. 
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Altair and the Constellation Transportation 
Architecture 

The Altair lunar lander is an integral component 
of NASA’s Constellation Program. It is joined 
by the Orion crew exploration vehicle, the Ares I 
crew launch vehicle and the Ares V heavy-lift 
launch vehicle to complete the Constellation 
transportation system. Altair ’s fundamental 
function is to transport crew and cargo from 
lunar orbit to the moon’s surface, and to return 
crewmembers back to lunar orbit. Altair is also 
closely coupled to Constellation’s Lunar Surface 
Systems, providing transportation and selected 
services to lunar surface habitats, rovers, science 
experiments and logistics. 

Altair performs 3 distinct, but related, missions. 
A “sortie” mission will deliver a crew of 4 and 
up to 500 kg of payload to any point on the lunar 
surface and support the crew for up to 7 days 


prior to returning to low lunar orbit (LLO). An 
“outpost” mission will deliver a crew of 4 to the 
site of a lunar outpost or other suitable pre- 
deployed assets, and remain on the lunar surface 
for up to 210 days in long-duration quiescent 
mode until the crew returns to LLO. And a 
“cargo” mission will autonomously deliver up to 
14.5 mt of cargo to the lunar surface. 

In crewed modes, Altair’s first function is to 
perform Orion- Altair stack attitude control and 
Trajectory Correction Maneuvers (TCM) during 
trans-lunar coast. It also performs stack Lunar 
Orbit Insertion (LOI), stack attitude control in 
LLO prior to lunar descent, de-orbit, lunar 
landing, lunar ascent. LLO rendezvous with 
Orion, and disposal. Cargo landers perform 
attitude control and Trajectory Correction 
Maneuvers (TCM) during trans-lunar coast, LOI, 
de-orbit and autonomous lunar landing. As part 
of project formulation activities, a detailed 
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operations concept and function derivation has 
been performed in order to inform the definition 
of Altair system requirements. 

The Altair System 

Altair currently consists of four major 
components: an Ascent Module (AM), a Descent 
Module (DM), an Airlock and the Ares V Earth 
Departure Stage/ Altair Adapter (EDSA). The 
AM is built around a crew cabin that serves as 
the primary habitable volume for the crew during 
at least the descent and ascent phases of the 
crewed sortie mission, and provides pressurized 
access to the Airlock and Orion. Altair’ s DM 
main function is to deliver hardware (AM with 
crew. Airlock, cargo) to the surface of the Moon, 
and is built around the descent propulsion 
system, landing gear, and structure necessary to 
carry loads through all flight phases. The 
Airlock module provides ingress/egress access to 
the Altair AM in the Sortie mission mode. The 
Airlock allows the crew to perform split 
operations (e.g. two crew members perform 
EVA while two crew members remain in the 
Altair) and serves as one of the primary 
mechanisms used to control the transport of 
lunar dust into the AM. Different combinations 
of these modules yield 3 separate configurations 
of the lander for crewed sortie missions 
(AM+DM+airlock, see Figure 1), crewed outpost 
missions (AM+DM) and dedicated cargo 
delivery (DM only). 


Ascent 

Module 


Module 

Figure 1. Altair P905-A configuration 



This initial design was chosen with some 
thought. Over the past decades, NASA has well 
over 1 00 discrete lander designs that explored 
the trade space variables of staging, delta-V split, 
propellant types, crew size, surface duration, 
launch configuration, landing configuration, 
launch shroud dimensions, abort capabilities, 
crew access, cargo accessibility and offloading, 
C.G. control, and a myriad of other, often 
competing, design drivers. Based upon this 
history of studies, and the specific features of the 
overall Constellation architecture, the Altair 
Project selected a configuration to begin its risk- 
informed design process - a two stage vehicle 
using a large, efficient LOX/LH2 stage for LOI 
and landing, a small, lightweight ascent stage for 
crew habitation and “flight deck” functions, and 
a separate airlock. 

This choice of initial configuration was 
necessary to initialize the risk-informed design 
process, and has been held constant to enable this 
design process to proceed. Freezing a design 
early in the process does create a risk that this 
initial (likely non-optimal ) design choice 
becomes confused with THE ultimate design. 
However, an important step that has been 
inserted into the Altair design process is to 
periodically “step back” and re-evaluate the 
vehicle configuration to assess if the team is 
pursuing the most optimum design. Having just 
completed the initial cycles of risk reduction and 
reliability improvements, the next step in the 
Altair project will be re-assessing overall vehicle 
configuration. 

Risk-Informed Design 

The Altair project is using a design approach that 
is unique to prior NASA human spacecraft 
projects 1 . A typical NASA project first begins 
with a set of requirements that describe the 
entirety of the functions and performance a 
spacecraft must possess, and a vehicle is then 
designed to satisfy all of these requirements. 

This process results in a design that initially 
attempts to meet all requirements equally, and 
from which it is difficult to extract capability if 
the vehicle is found to exceed mass or cost 
limitations. Altair ’s approach was to first design 
a vehicle that meets only a minimum set of 
requirements, and then incrementally add 
functions and performance back into the design. 
This approach allows the decision to accept each 
additional requirement to be informed by its 
individual impact to cost, performance and risk. 


2 


This process was derived in part from NASA 
Engineering Safety Center Report NESC PR-06- 
108, “Design, Development, Test and Evaluation 
(DDT&E) Considerations for Safe and Reliable 
Human-Rated Spacecraft Systems” 2 . 

After defining the “minimum functional” vehicle 
in the first Lander Design Analysis Cycle 
(LDAC-1), subsequent design cycles identified 
major risks that affected the safety of the crew 
(LDAC-2), and the success of the mission 
(LDAC-3). By using risks to inform these early 
design cycles, the Altair Project was able to 
identify the specific performance “cost” of each 
increment of crew safety and mission reliability 


that was added to the minimum spacecraft 
design. Residual spacecraft risks will continue 
to be re-evaluated as subsequent design cycles 
assess the performance, cost and risk impacts of 
adding additional vehicle functionality, and other 
factors such as manufacturability and 
maintainability. Figure 2 illustrates the timeline 
of the Lander design cycles. 
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Figure 2. Altair Lunar Lander Design Cycles 


Design Analysis Cycle Summaries 

The first step of the process is to establish a 
“minimum fimctionality” baseline design. This 
requires that the design team scrub the vehicle 
requirements back to a small number that 
described the essential functions and constraints 
of the lander. For the Altair lander these “core” 
requirements were to carry 4 crew to the surface 
for 7 days with 500 kg of payload, to loiter for 
up to 210 days at a polar outpost, to deliver 
14,500 kg of dedicated cargo, to package within 
the Ares V shroud, to perform the lunar orbit 
insertion bum with the Orion spacecraft attached, 
to carry an airlock, and to work within the 
Constellation EOR-LOR architecture. Key 
constraints were control masses of 45,000 kg for 
crewed missions and 53,600 kg for cargo 
missions. 


The Minimum Functional design provided the 
baseline from which to identify vehicle risks in 
order to mature the design from one that was 
essentially “single string” to one that was “safety 
enhanced”. Risks that contributed most directly 
to the Loss of Crew (LOC) would be first 
identified, and mitigation options would then be 
studied for these risks. Decision processes were 
developed for both selecting the LOC risks to be 
studied, and evaluating the mitigation options 
that would be incorporated into the LDAC-2 
design. For this initial risk reduction cycle, the 
primary measures would be mass and change to 
risk. The outcome of Altair s LOC risk 
reduction design cycle was to reduce LOC from 
1 :6 to 1 :206 by expending 1300 kg of mass for 
more robust components, selective redundancy, 
or dissimilar system backups 1 . This very first 
cycle of risk-informed design brought the lander 
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design close to the target LOC requirement of 
1:250. 

The third Altair design cycle focused on Loss of 
Mission (LOM) risks in the same way that LOC 
risks were addresses in the previous cycle. 
Lander reliability risk areas were identified, and 
options studied that would increase reliability at 
different levels of mass expenditure. The team 
also began to incorporate other capabilities, such 


as the ability to land on any site on the lunar 
globe. This “Global Access” capability will be 
“bought back” in the same way that safety and 
reliability are re-introduced into the minimum 
design - with known impact to risk and 
performance. The progression of Altair designs 
through the design cycles described above is 
shown in Table 1. 


“Minimum Functional” design 

8.4 m Ares V shroud, 45 1 control mass 


“Safety Enhanced” 
10 m Ares V shroud 


“Reliability En ha nc^^^l 
Design maturation 



Sortie Mission 


Ascent Module 

5,340 kg 

5,075 kg 

5,300 kg 

6,494 kg 

Hab Module 

1,843 kg 

949 kg (Airlock only) 

1,053 kg (Airlock only) 

1,173 kg (Airlock only) 

Descent Module 

33,976 kg 

32,718 kg 

33,845 kg 

33,483 kg 

PMR 

3,511 kg 

2,858 kg 

3,130 kg 

2,008 kg 

Unallocated 

331 kg 

3,652 kg 

1,671 kg 

1,254 kg 


LLPO Design Cycle: LDAC-1 LDAC-1A LDAC-2 LDAC-3 


[Cargo Mission 


Descent Module 

33,743 kg 

34,248 kg 

35,656 kg 

37,177 kg 

PMR 

2,304 kg 

1,974 kg 

2,135 kg 

2,003 kg 

Unallocated 

14,136 kg 

17,378 kg 

1 5,808 kg 

14,794 kg 

Crew to Outpost Mission 

Ascent Module 

5357 kg 

5,356 kg 

5,525 kg 

6,763 kg 

Descent Module 

33,868 kg 

32,684 kg 

33,711 kg 

33,099 kg 

PMR 

3,009 kg 

2,691 kg 

2,940 kg 

1,899 kg 

Unallocated 

2,766 kg 

4,269 kg 

2,824 kg 

2,653 kg 


Table 1. Altair Lander Configuration and performance maturation using Risk-Informed Design 


Risk-informed design provides early, critical 
insight into the overall viability of the end-to-end 
architecture, and provides a starting point to 
make informed cost/risk trades so that risks can 
consciously be bought down. The Altair team 
has used the education afforded by risk-informed 
design to look at risk reduction in its many forms 
and not to blindly apply fault tolerance rules or 
preconceived risk reduction solutions. The 
process inherently produces risk metrics for each 
added capability, and cost analysis can easily be 
added to facilitate evaluation of the true cost and 
risk changes that accompany each added 
capability. Perhaps most importantly, risk- 
informed design creates a true “Smart Buyer” 
team that inherently understands the balance of 


risk drivers and mass performance within the 
design. 

Industr\ f Lander Studies 

In 2008, the Altair office signed contracts with 5 
aerospace contractors to conduct parallel studies 
of risk-informed lander design. The companies 
were given the same set of requirements used by 
NASA’s in-house Altair team and asked to 
independently derive their own “minimum 
functionality” lander design, and then to suggest 
innovative approaches to improving the safety 
and reliability of this design. The contractor 
teams identified areas where NASA’s initial 
design could be further minimized, and where it 
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required additional performance to achieve only 
the essential functions. Each using their own 
form of risk-informed design, the contractors 
prioritized safety “buyback” candidates, 
identifying propulsion, structures and physical 
configuration trades as the largest performance 
drivers. 

The contractor teams were also encouraged to 
pursue alternative configurations and innovative 
design solutions. The teams created lander 
concepts that investigated alternative tank 
configurations, alternative propellants, different 
numbers of engines and engine placement, 
alternative ascent module pressure vessels, 
different structural systems, and even variants to 
the number of landing gear. An example of the 
alternative contractor concepts is shown in 
Figure 3. In addition to the innovative design 
work, the contractors also exhibited a 
willingness to work with NASA and with each 
other m a collaborative work environment where 
ideas could be shared and discussed openly. The 
industry studies validated NASA’s risk-informed 
design approach, and provided an excellent 
initialization for future design cycles that will 
partner NASA and industry. 



Figure 3. Examples of Industry lander concepts 

Revisiting Configuration Decisions and 
Maturing the Design 

Risk-informed design works best when the 
configuration of the spacecraft is held constant, 
so as not to introduce additional variables into 
the design. It is also a time consuming process 
that may not work for projects with compressed 
schedules (the first 3 design analysis cycles took 
the Altair team approximately 24 months to 
complete). To optimize the risk-based design 
effort, the Altair team chose to hold the vehicle 


design constant throughout the design cycles, 
with a plan to revisit vehicle configuration once 
LOG and LOM “buyback” cycles were complete. 

With the completion of the risk and reliability 
design cycles, the next step is to prioritize the 
configuration and maturation studies that would 
have the greatest impact on the vehicle design. 
Altair considered a list of over 200 potential 
configuration/maturation trades, and from that 
list chose the following studies as the basis for a 
Trade Analysis Cycle (TAC) that was inserted 
into the vehicle’s development schedule. This 
list includes: 

• Alternate Descent Module Configuration 

• Alternate Ascent Module and Airlock 
configuration 

• Alternate AM/DM separation concepts and 
analyses 

• Structural Stiffness Design 

• Descent Module Tank Residuals 

• Human piloting capability maturation 

• Ops Con/Ops Timeline maturation 

• Spacecraft “safe” configuration for critical 
faults 

The completion of the Trade Analysis Cycles 
will result in a fresh look at the lander design to 
determine if the current configuration is 
optimum for the current architecture. Possible 
changes may include a reduced number of 
descent tanks, alternative descent stage structure, 
alternative placement of the ascent module and 
airlock, change of the ascent module pressure 
vessel shape, and alternative methods of 
packaging cargo. It is important for a design to 
be revisited on occasion - engineers sometimes 
become enamored with our designs and fail to 
see large innovative or even subtle alternatives 
that may improve the design solution. 

Scheduling regular revisits of the design 
configuration into the design process flow offers 
the team the opportunity to “step back” and 
better optimize the design solution. 

Looking Ahead 

The Altair lunar lander team now possesses the 
knowledge of risk and reliability improvements 
that can be “bought back” into any lander design. 
The Altair team will use this knowledge to 
inform the totality of activities that must be 
performed during Phase A. Contractors have 
validated the risk-informed design process, and 
suggested alternative configurations, and other 
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potential areas of study. From the combination 
of these early analysis cycles the Altair office 
has assembled a master list of over 200 tasks that 
it will undertake to re-assess lander 
configuration, mature subsystem designs, and 
continue decrementing LOG and LOM risks. At 
the same time the office is conducting these 
technical studies, it is also validating system 
requirements in preparation for a Constellation 
Program Systems Requirements Review for the 
early lunar missions 3 , as well as maturing its own 
Systems Requirements, Interface Requirements, 
and other documents in preparation for its own 
upcoming Systems Requirements Review. 

These are critical Phase A activities. The Altair 
Project has sought to streamline NASA 
processes and combine the design expertise of 
NASA and industry, and will continue to 
combine the best of NASA and industry as it 
moves from conceptual design into its 
preliminary design phase. 
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Overview 


♦ Altair Mission Overview 

♦ Altair Risk Informed Design Approach 

♦ Current Lander Design Overview 

♦ The Path Forward 


♦ Summary 
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Components of Program Constellation 




Earth Departure 
Stage m 


Crew Exploration 
Vehicle 


Heavy Lift 

Launch 

Vehicle 


Lunar 

Lander 


Crew Launch 
Vehicle 



Typical Lunar Reference Mission 



100 km 
Low Lunar 
Orbit 




Section 05: Altair System 
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Altair Risk Informed Design Approach 


“Minimum Functional” design 

8.4 m Ares V shroud, 45 mt control mass 


“Safety Enhanced” design 
10 m Ares V shroud 




LDAC-2 


LDAC-3 


Altair Design Cycle: 


LDAC-1 


LDAC-1A 


Altair Design Analysis Cycles (LDAC) Focused on Risk 


LDAC-1 - Minimum Functional Vehicle 

LDAC-1 - Minimum Functional Vehicle with optimized descent module structure 
LDAC-2 - Safety/Reliability (crew) Upgraded Vehicle 


LDAC-3 - Safety/Reliability (mission) Upgraded Vehicle 



Benefits of Risk Informed Design 


♦ Provides early, critical insight into the overall viability of the end- 
to-end architecture 

♦ Provides a starting point to make informed cost/risk trades and 
consciously buy down risk 

♦ Inherently minimizes interfaces leading to a vehicle that is not over 
designed and costly 

♦ Facilitates derivation of mandatory design requirements 

♦ Facilitates evaluation of what other capabilities cost 

♦ Builds and informed Project team 

♦ Eliminates mass added due to blind application of fault tolerance 
rule 

♦ Minimizes amount of redesign required at the end of the design 
process due to vehicle exceeding mass budget 



Understanding risk drivers enables mass, power, 
cost trades to be done in a fully informed manner 
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LDAC-1 Starting Point 


DRMs and Requirements 



♦ 3 DRMs with Mission Timelines and Functional Allocations 

• Sortie Mission to South Pole 

- 4 Crew / 7 Days on Surface / No support from surface assets 

- No restrictions on ‘when’ (accommodating eclipse periods) 

• Outpost Mission to South Pole 

- 4 Crew with Cargo Element (LAT Campaign option 2) 

- Outpost provides habitation on surface (down and out) 

- 210 Days with surface support (power) 

• Cargo Mission to South Pole 

- Short duration, large payload 

♦ ‘Hard’ Requirements 

• 4 Crew 

• 7 Day Sortie 

• 210 Day Outpost 

• Airlock (implemented on sortie mission only) 

• CxP transportation architecture 

- 8.4 meter shroud, TLI Loads, Lander performs LOI burn, 

• Control Mass 

- Total Lander mass at TLI for crewed missions: 45,000 kg 

- Total Lander mass at TLI for cargo missions: 53,600 kg 

• Delivered payload: 500 kg (sortie DRM), 14,500 kg (cargo DRM) 

• Returned payload: 100 kg min/250 kg goal (sortie, outpost mission DRMs) 



CEV IRD, etc 


7 





>r, 



LDAC-2: Improving Lander Safety 



♦ Purpose: 

• Upgrade the Lander from a minimum functional vehicle to a minimum flyable 
vehicle by incorporating safety and reliability design changes that target the 
highest risks identified in LDAC-1 

♦ Key Questions: 

• What data is required to evaluate the proposed design changes intended to 
reduce risk? 

• What concepts will be incorporated in the DAC-2 Lander? 

♦ Analysis Products 

• Fault Tree 

• Subsystem architecture with A Reliability 

• Subsystem operation during degraded modes 

• Requirements for Abort Scenario’s 

• System Performance During Abort Scenario 

♦ Measures l 5 

• A Risk Rating k 4 

• A Mass E 

• A Cost I" 3 

H 

O 2 
O 

D 1 



CONSEQUENCE 
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LDAC-2 Integrated Risk Analysis Tasks 


| Task# | Task Title | 

Vehicle Performance/Control 


2 

Vehicle Dynamic CG Management 

3 

Determine Vehicle Performance for Surface 
Landing 

6 

Prevent Ascent Module Re-Contact During 
Launch 

16 

Improve Reliability of the GN&C System with 
respect to Ascent, Descent, Landing and LLO 

33 

Improve Communication System Reliability to be 
Able to Update the State Vector 

14 

Develop Mission Abort Timelines for Descent and 
Ascent 


Propulsion 


8 

Improve Reliability of Descent Main Engine 

9 

Improve Reliability of Descent Reaction Control 
System 

20 

Improve Reliability of Ascent MPS and RCS 1 

25 

Improve Reliability of Thrust Vector Control for 
Descent Main Engine 

26 

Improve Reliability of Main Propulsion System 
Instrumentation 

28 

Increase Reliability of Ascent Module Main Engine 

29 

Prevent freezing of the Hypergol Main and RCS 
(ascent and descent) Propulsion Systems 

34 

Improve Reliability of the Descent Main 
Propulsion System 


Power 


10 

Improve Reliability of Descent Module Power 
System 

11 

Improve Reliability of Ascent Module Power 
System 

30 

Improved Safety of Main Ascent Module Battery 

32 

Improve Fuel Cell Safety 

5 

"Lifeboat" Minimum AM Power Requirements 

Life Su 

sport 

12 

Increase Reliability of C02 Scrubbing System 

13 

Increase Reliability to Prevent Loss of Breathable 
Atmosphere 

17 

"Lifeboat" minimum breathable atmosphere 
requirements 

Structures 

15 

Increase reliability of ascent stage/airlock 
separation system 

23 

Improve Landing Gear Deployment, Locking and 
Load Attenuation Reliability 

24 

Increase Reliability of AM/DM Attachment and 
Separation Mechanisms 

Thermal 

4 

Improved Thermal System Reliability 

Environment 

19 

Determine Radiation Environment and Mass 
Threat for Protection 

21 

Determine MMOD Environment and Mass Threat 
for Protection 


P(LOC) 



Summary LDAC-2 Results: 

Probability of Loss of Crew, Mass Available for Payload 


Sum of System Contributions to LOC/ 
Mass Available for Payload 



Individual Subsystem 
Contribution to LOC: 

□ Events\Hazards 

□ Life Support 
■ Thermal 

□ Propulsion 

□ Structures and Mechanisms 

□ Power 

□ Avionics 

-•-Mass Available for Payload 


Note: P(LOC) based on simplified models and identified risk 


Note: The LDAC-2 vehicle was not a “fully functional” design 
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LDAC-2 Lander Design 




LDAC-2 work resulted in 
“preliminary design” with 
system level products 

• Detailed subsystem 
schematics based on required 
vehicle functionality 

• Preliminary component sizing 
based on performance 
analysis 

• MEL based on subsystem- 
level details 

LDAC-2 design incorporated 
LOC mitigation upgrades to 
“minimum functional” 
design 
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LDAC-3 Overview 



♦ Primary objective was to identify loss of mission (LOM) risk 
drivers and develop potential changes that improve overall loss of 
mission risk 

• Some general vehicle design and analysis maturation activity was also 
completed 

♦ Loss of crew is easily understood, but LOM definition / 
understanding proved more difficult 

♦ LDAC-3 LOM assessment used as a “tool” to support design 
development and not as some operational success type of 
measure 

• In this context, loss of mission was different than mission success 

• Loss of mission - Inability to fully complete significant / primary mission 
objectives (this is more stringent) 

• Mission Success - Measure for how successful a given mission is given 
desired vs actual accomplishment (easier to achieve) 

♦ 8 mission objectives defined for LDAC-3; violation of any one was 
declared LOM 


►c ! 
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LOM Reduction Buy Back Summary 




Subsystem 

Changes 

Power 

• Updated cable mass assumptions 

• Improved reliability of the power bus by adding circuit bypass and change to 
latching relays 

• System resized to 3kW average and 6kW peak power 

Propulsion 

• Implemented series -parallel redundant bi-prop valves with vehicle supplied 
pneumatics for the Ascent Main Engine 

• Added three-string regulators with pyro ladder on AM RCS to isolate NTO 
during surface stay 

• Incorporated autogeneous pressurization to DM system (reduces He need) 

• Adopted warm / cold He strategy for fuel / oxidizer pressurization 

• Added redundant injector heaters and heat pipes for DM RCS 

Structures / 
Mechanisms 

• Updated DM, EDSA, ad RCS struts to composite construction 

• Updated Airlock pressure shell design to composite 

• Improved fidelity of AM pressure vessel and hatch (to Orion) design 

• Selected guillotine cutter concept for umbilical separation and matured EDSA 
separation system 

Life Support 

• Cabin air and suit loop 02 LOM reliability improvement 

• Sized potable “fixed charge” and ECLSS bellows water tanks for redundancy 

• Added handheld water mist extinguisher for local fire suppression 

• Added point of use filters at water supply valves 
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LOM Reduction Buy Back Summary 




Subsystem 

Changes 

Thermal 

• System resized to ~6.1 kW, increasing radiators to four 

• Implemented sublimator bypass and accumulator with bubble filter for LOM 
redundancy 

C&DH 

• Included capacitive discharge pyro firing circuit architecture 

• Implemented three flight computers (from two) 

C&T 

• Improved fidelity of RF cable mass estimates 

• Implemented a single transponder, two software defined radios architecture 

GN&C 

• Added optical navigation sensor suite, third IMU, and sixth descent radar 
antenna for LOM 

• Enhanced lidar targets and added running lights to support RPODU operations 

EVA 

• Updated battery charger to a three-channel Li-Ion charger 

• Added additional contingency equipment 

• Added two suit donning stands in Airlock 

Vehicle System 

•Added vehicle functional checkouts to timeline / ops con baseline 
• Incorporated basic hardware for lunar surface propellant scavenging 


Changes 










Current Altair Reference Design Overview 
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Altair Configuration Variants 
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Altair Probability of Loss of Crew 
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Altair Basic Vehicle Configuration / 
Architecture Background 

♦ The basic Altair configuration / architecture is subject to multiple design 
drivers: 

• Cost, schedule, and risk 

• General performance, mass, and functionality to reach the moon and return within a 
given lunar transportation architecture 

• Specific functions and capabilities necessary/desired to achieve mission objectives 
including outpost buildup 

• Other 

♦ Altair efforts to date have focused on areas #1 & #2 

♦ Item #3 is more important to vehicle utilization and other constellation 
elements, especially surface systems. 

♦ Numerous alternate architecture options exist. Many tend to address a 
specific concern, capability, feature, or other figure of merit (FOM) from #3 

• Achieving these often compromise #1 or #2 

• No architecture will satisfy everything 

• Project challenge is to avoid investing too much into a configuration that addresses only 
a specific concern/capability/FOM and invest in configurations that provide highest 
potential to achieve the best balance. 
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Selected Lessons Learned From Risk- 

Informed Design 

♦ Full redundancy was usually heaviest, frequently NOT most effective for 
improving LOC 

• Investigate other means for driving down critical risks - dissimilar redundancy, higher 
reliability parts/designs, increased testing, etc. 

♦ LOC and LOM are often interrelated, so risk buy-down decisions should 
be made on the basis of the best balance between the two 

♦ Quantitative risk tool was necessary to inform good design decisions 

• Always necessary to correlate engineering judgment with tool results 

• Tool forces team to reconsider 

• However, cannot rely solely on tool results. Must be able to technically explain 
decision. 

♦ A risk tool the designers can interact with is a significant aid - improves 
tool and design 

• e.g., when a result did not correlate with engineering experience, designers could 
easily understand model in tool. Sometimes changed model and sometimes did not. 

♦ Design for Minimum Risk is the way to go if you are trying to build a smart 
design team 
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The Path Forward 



♦ Continue Project Formulation (Phase A) activities in a risk 
informed manner 

• Demonstrate that there is a mission concept that “fits in the box”. 

• Develop sound bottoms-up requirements for Altair. 

- Utilize model based system engineering principles 

• Provide data and knowledge for project to project integration. 

- Altair team includes representatives from Orion, Ares V, GO, EVA, and LSS. 

• Provide data and knowledge for Level 2 integration and architecture trades 

• Provide informed data for cost estimation 

- Have detailed bottoms-up and top-down cost data to support project planning 

• Complete other Project formulation tasks, including 

- Upfront system engineering to enable cost, risk, schedule, and requirements 
trades 

- Technology maturation planning 

- Concept of Operations 

- End to end testing guidelines 
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Summary 
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♦ The Altair Project began with the 100+ Lander concepts developed 
after ESAS, assessed the alternatives, and began design work. 

♦ Altair has taken methodical, risk informed design approach 

♦ A real design concept exists 

• Current Master Equipment List includes over 4000 items for the sortie 
lander 

• CAD models contains >3500 parts and subassemblies 

• Detailed structural analysis (FEM, Nastran) 

• Integrated schematics and individual system schematics, etc. 

♦ Current design concept is a POD, not necessarily “the” design 

• Too early to downselect to point design 

• However, a critical part of the process to: 

- Understand design drivers well enough to write good requirements for SRR 

- Ensures integration with overall Cx architecture 

- Ensures a viable mission concept exists 
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